SANS Stormcast Wednesday, November 11th, 2026: Microsoft Patch Tuesday Outlook Spoofing (CVE-2026-124194); Apple Bluetooth and iMessage Fixes; SAP NetWeaver CVSS 10s (CVE-2026-89103)
MentionsAppleMicrosoftSAPGoogleActive DirectoryGoogle ChromeiOSmacOS
Runs 9:32. Streams from traffic.libsyn.com only when you press play.
Microsoft's November Patch Tuesday, Apple's iOS and macOS updates, and SAP's Security Patch Day all arrived this week, including an already exploited Outlook spoofing bug and four SAP flaws with a perfect CVSS score of 10. Microsoft Patch Tuesday Microsoft is addressing 1,260 vulnerabilities this month, 68 of them critical, including 167 Chromium issues that affect Microsoft Edge. One already exploited Outlook spoofing vulnerability, CVE-2026-124194, may hide the risk of a file being opened, in a Mark of the Web style issue, though Microsoft does not rate it critical.
Show notes from SANS Internet Storm Center StormCast.
Explained
The technology and terms in this story. Learn more
- ConceptPatch TuesdayMicrosoft's monthly security update day, the second Tuesday of every month.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- AttackRemote code execution · RCEA flaw that lets an attacker run their own code on someone else's machine over the network.
- TechnologyActive DirectoryMicrosoft's directory of users, computers and permissions that most corporate Windows networks are built on.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
- CWE-356Product UI does not Warn User of Unsafe Actions
- CWE-416Use After FreeThe program keeps using memory after releasing it, so an attacker who controls what lands there next can hijack execution.
- CWE-787Out-of-bounds WriteData is written outside the memory it belongs to; the most common root cause of exploited memory bugs.
- CWE-863Incorrect AuthorizationA permission check exists but is wrong, letting users act beyond their role.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
